Claude Process Execution on Servers
This rule detects the execution of processes with filenames starting with 'claude' on server devices. It specifically targets server endpoints by filtering device information to include only 'Server' device types and then joins this with process execution events. This could indicate the presence or execution of AI-related tools or unauthorized software on critical infrastructure.
Microsoft Sentinel (KQL)
